How to get a point to point tun0?

Question 1

I have comments and suggestions. The comments are:

1) `eth0` and `eth2` can perfectly live without ip4 address. 
An ip4 address is not mandatory at all.
2) `eth2` seems to be dummy.
3) Virtual Ethernet is possible. Ethernet supports point-to-point.

For more information on virtual Ethernet I recommend sides like this or that. lo is a virtual However, a ssl/tls is not necessary for a tunnel

My suggestions are the following:

1) `eth0` and `eth2` are ok. I don’t see any reason for changes. 
You don’t need to add an ip address.
2) The mask of `tun0` seems not to work. It could be that this is a bug or a feature.
I don’t know a workaround. Could you please crosscheck it?
3) You must setup also a route if you want to use a tunnel.
Please check with `route -n` if you have set it.
I expect a route to `192.168.99.XYZ`.
4) If you haven’t set up any route, you can do it in `interface` by adding this
`up iptables -t nat -A POSTROUTING -s 192.168.99.XYZ/255.255.255.252 -j MASQUERADE` and 
`down iptables -t nat -A POSTROUTING -s 192.168.99.XYZ/255.255.255.252 -j MASQUERADE`
at the end of `tun0`. Replace `XYZ` with the ip address of server 2. 
Maybe the mask at the ip addresses will work.
5) If you want to set a hardware address, you have to use the `-` instead of the `:`.
However, I doubt that `hwaddress ether 00-00-00-00-00-00` will work because it is an
invalid address. But, give it a try.

Answer

I have comments and suggestions. The comments are:

1) `eth0` and `eth2` can perfectly live without ip4 address. 
An ip4 address is not mandatory at all.
2) `eth2` seems to be dummy.
3) Virtual Ethernet is possible. Ethernet supports point-to-point.

For more information on virtual Ethernet I recommend sides like this or that. lo is a virtual However, a ssl/tls is not necessary for a tunnel

My suggestions are the following:

1) `eth0` and `eth2` are ok. I don’t see any reason for changes. 
You don’t need to add an ip address.
2) The mask of `tun0` seems not to work. It could be that this is a bug or a feature.
I don’t know a workaround. Could you please crosscheck it?
3) You must setup also a route if you want to use a tunnel.
Please check with `route -n` if you have set it.
I expect a route to `192.168.99.XYZ`.
4) If you haven’t set up any route, you can do it in `interface` by adding this
`up iptables -t nat -A POSTROUTING -s 192.168.99.XYZ/255.255.255.252 -j MASQUERADE` and 
`down iptables -t nat -A POSTROUTING -s 192.168.99.XYZ/255.255.255.252 -j MASQUERADE`
at the end of `tun0`. Replace `XYZ` with the ip address of server 2. 
Maybe the mask at the ip addresses will work.
5) If you want to set a hardware address, you have to use the `-` instead of the `:`.
However, I doubt that `hwaddress ether 00-00-00-00-00-00` will work because it is an
invalid address. But, give it a try.

Question 2

If your description is correct, you don't need a tunnel, you need to fix your configuration and possibly your routing. Let's sum this up:

Server 1:

eth0 connected to some unknown ethernet segment A, without a valid IPv4 address, and a netmask of 255.255.0.0 that's useless because there's no valid IP4 address. It may receive broadcasts on the MAC level and IPv6 for its local link address, but neither sending nor receiving broadcasts, nor anything else IPv4 will work without a valid IPv4 address.
eth1 connected some ethernet segment B with 192.168.2.0/24 in this segment, a gateway at 192.168.2.1 and the option to route into some segment C with 192.168.99.0/24

Server 2:

eth? conneced to segment C with 192.168.99.0/24

Ping between server 1 and server 2 works, so ICMP packets must be correctly routed from segment B to segment C. Telnet and some unspecified application don't work, which means TCP packets are not correctly routed from segment B to segment C.

To establish a tunnel between server 1 and server 2, you'll need a connection between server 1 and server 2 that works realiably for TCP or UDP packets. Then you can "tunnel" packets directly over this connection. However, since you have a connection in the first place, a tunnel is not really necessary, you could just use this connection. Exception: Your router blocks TCP packets, but not UDP packets, then you could use UDP to encapsulate TCP.

So you must fix whatever prevents the connection between server 1 and server 2 from working. That problem is in the router (which you have told us nothing about), and possibly in the network between segment B and segment C (which you also have told us nothing about).

Answer